Heap-buffer-overflow in read_blob_signed in yara
Summary
OSV-2022-510: Heap-buffer-overflow in read_blob_signed. Affects yara versions >= 15ec337e041791d5a354c8a3ec7729ab5af6adf4, < 86b0e3f7c7fc2c689db88972221b5d4da1c7214f. Fixed in 86b0e3f7c7fc2c689db88972221b5d4da1c7214f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Yara is an open-source tool designed for malware identification and classification. It allows users to create rules to detect and analyze patterns in files and processes. Yara is widely used in the cybersecurity community to develop custom signatures for malware detection. However, a vulnerability has been discovered in the read_blob_signed function of Yara, which can lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability in Yara's read_blob_signed function can be exploited to trigger a heap-buffer-overflow read of 4 bytes. This can result in a crash and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. The issue was reported through the OSS-Fuzz project and has been assigned a high severity level. The vulnerable code path involves the functions parse_signature_type and parse_signature_type.
How To Fix
Minimum fixed version
86b0e3f7c7fc2c689db88972221b5d4da1c7214f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider implementing input validation and sanitization measures to mitigate the risk of exploitation. This can involve checking the size of input buffers and ensuring they do not exceed the expected limits. However, applying the official fix by updating Yara is the recommended solution.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been identified in the read_blob_signed function of Yara. This vulnerability can lead to crashes and potential code execution. It is crucial to update Yara to the latest version to mitigate this issue. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yara →
FAQ
Yara is an open-source tool used for malware identification and classification. It allows users to create custom rules to detect and analyze patterns in files and processes.
A heap-buffer-overflow is a type of memory corruption vulnerability where data is written beyond the bounds of a dynamically allocated buffer in the heap. This can lead to crashes, arbitrary code execution, or other security issues.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software to uncover potential vulnerabilities.
This vulnerability has been assigned a high severity level due to its potential impact on the stability and security of Yara.
To fix this vulnerability, it is recommended to update Yara to the latest version, which includes the necessary patches to address the heap-buffer-overflow issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for yara.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
